diff --git a/routes/index.js b/routes/index.js
index 6b5455f03e4..b439014d659 100644
--- a/routes/index.js
+++ b/routes/index.js
@@ -103,8 +103,15 @@ exports.save_account_details = function(req, res, next) {
     profile.firstname = validator.rtrim(profile.firstname)
     profile.lastname = validator.rtrim(profile.lastname)
 
-    // render the view
-    return res.render('account.hbs', profile)
+    // render the view, passing only the known profile fields so that
+    // request data cannot override view/template resolution options
+    return res.render('account.hbs', {
+      firstname: profile.firstname,
+      lastname: profile.lastname,
+      country: profile.country,
+      phone: profile.phone,
+      email: profile.email
+    })
   } else {
     // if input validation fails, we just render the view as is
     console.log('error in form details')